netflix-uat[.]dblxhosting[.]co[.]uk

This domain is flagged as a high-risk credential phishing site specifically targeting Netflix UAT (User Acceptance Testing) environments. Analysis indicates the site is designed to harvest login credentials by mimicking the official Netflix UAT login portal, as evidenced by the page title 'Log in - Netflix UAT.' The threat remains active, posing significant risk to users who may inadvertently disclose sensitive authentication details. Infrastructure analysis reveals multiple concerning indicators. The domain netflix-uat.dblxhosting.co.uk was registered on July 06, 2020, through Gandi (registrar tag GANDI) and currently resolves to the IP address 34.206.156.141, hosted on Amazon.com, Inc. infrastructure (AS14618). The SSL certificate is issued by Amazon RSA 2048 M03, a common provider for both legitimate and malicious sites. Detection metrics further confirm the threat, with 21 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on two security blocklists and is actively blocked by PhishDestroy and Phishunt, reinforcing its classification as a confirmed phishing resource. Mitigation steps for this credential phishing threat include immediate domain blacklisting at the network perimeter to prevent user access. Organizations should implement email and web filtering rules to block all traffic to and from netflix-uat.dblxhosting.co.uk, particularly for users involved in UAT or testing environments. End-user education should emphasize the risks of entering credentials on unverified login pages, even those resembling internal testing portals. Security teams are advised to monitor for credential reuse attempts and enforce multi-factor authentication (MFA) for all Netflix-related accounts to mitigate the impact of potential credential compromise. Given the domain's persistence since 2020, continuous monitoring for related infrastructure or newly registered lookalike domains is recommended.